When using FTK Imager to preview a physical drive, which number is assigned to the first logical volume in an extended partition?

In FTK Imager and similar disk partition schemes, logical volumes within an extended partition are assigned numbers starting from 5. This numbering convention arises from the way primary and extended partitions are structured on a hard drive.

The first four partitions on a disk can be primary partitions. Once the primary partitions are filled, the next available partition type is the extended partition, which serves as a container for logical volumes. The first logical volume created within this extended partition is universally assigned the number 5. Subsequent logical volumes would continue incrementing the number sequentially (e.g., 6, 7, etc.).

Therefore, understanding this numbering scheme is crucial for correctly navigating disk structures during forensic examinations and when using tools like FTK Imager. This distinction helps ensure forensic analysts accurately identify and work with the different partitions and volumes present on a drive.